Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdlfirstpurexml, a similar issue to CVE-2010-1632.
Recommended action: Upgrade to 2.2.9, 2.1.10 or 2.0.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.
Recommended action: Upgrade to 3.0.1, 2.7.8 or 2.6.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.
Recommended action: Upgrade to 2.7.4, 2.6.7 or 2.5.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
Recommended action: Upgrade to 2.7.3, 2.6.6 or 2.5.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.